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Amendments to the Claims 

The listing of claims will replace all prior versions, and listings of claims in the 
application. 

1. (currently amended) A method of on-the-fly patching of executable code comprising: 

identifying original instructions to be changed while the original instructions are 
being executed on a processor : 

copying the original instructions to a storage location; 

adding a jump instruction to the copied instructions to return to a next instruction 
after the original instructions; and 

replacing the original instructions while the original instructions are in the process 
of being executed on the processor with mark instructions and a transfer of control to a hook^ 

wherein the original instructions are part of the instruction set of the processor 
available to a user . 

2. (currently amended) The method of claim 1, fiirther comprising, prior to the copying 
allocating step, allowing a write operation on a page in memory where the original code is 
located. 

3. (currently amended) The method of claim 1, fiirther comprising, prior to the copying 
allocating step, masking interrupts. 

4. (original) The method of claim 1, fiirther comprising, after the replacing step, 
disallowing a write operation on the page in memory where the block of code is located. 

5. (original) The method of claim 1, further comprising, after the replacing step, 
unmasking interrupts. 
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6. (original) The method of claim 1, wherein the original instructions are changed in 
reverse order. 

7. (original) The method of claim 1, wherein the mark instructions are the same length, 
in bytes, as the instructions to be changed. 

8. (original) The method of claim 1, wherein the mark instructions are shorter in length, 
in bytes, as the instructions to be changed, and include NOP (no operation) filler. 

9. (original) The method of claim 1, wherein the modified instructions include a 
resolver to determine a number of the instructions at a location of the original code that had 
already been executed. 

10. (original) The method of claim 9, wherein the resolver determines a number of 
instructions that had already been executed using the mark instructions. 

11. (original) The method of claim 10, wherein, if the number of instructions that had 
already been executed is less than a number of original instructions to be changed, the resolver 
calls the copied instructions at the storage location so as to imitate a "no patch installed" 
scenario. 

12. (original) The method of claim 11, wherein, after execution of the instructions at the 
storage location, the resolver returns control to the next instruction. 

13. (original) The method of claim 1, further comprising enabling fiinctionality of the 
copied instructions at the storage location. 
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14. (original) The method of claim 13, wherein the enabling step comprises reconciling 
addressing in the instructions in the storage location. 

15. (original) The method of claim 13, wherein the enabling step comprises alignment of 
instructions in the instructions at the storage location. 

16. (original) The method of claim 1, further comprising verifying that the original code 
is susceptible to patching. 

17. (original) The method of claim 16, wherein the verifying step determines whether 
any mark instructions are already present in the original instructions. 

18. (original) The method of claim 16, wherein the verifying step determines whether 
any copy protect instructions are already present in the original instructions. 

19. (original) The method of claim 16, wherein the verifying step determines whether the 
original instructions include a suitable jump point that can be modified to the transfer of control 
to the hook. 

20. (original) The method of claim 16, wherein the verifying step determines whether the 
original instructions represent valid instructions. 

21 . (original) The method of claim 1, further comprising placing the hook in memory. 

22. (original) The method of claim 1, wherein the hook has been previously placed in 
memory. 

23. (original) The method of claim 1, wherein the replacing step uses an atomic write to 
replace the original instructions. 
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24. (original) The method of claim 23, wherein the atomic write replaces one instruction 
at a time. 

25. (original) The method of claim 23, wherein the atomic write replaces multiple 
instructions at a time. 

26. (currently amended) The method of claim 23, wherein, for Intel lA-32 architecture, 
the atomic write uses any of "xchg", "lock cmpxchgSb," "lock cmpxchg," and "lock xchg" 
instructions. 

27. (currently amended) A method of on-the-fly patching of executable code comprising: 

verifying that original instructions to be changed are susceptible to patching while 
the original instructions are being executed on a processor : 

generating pscudooriginal code from the original instructions at a different storage 
location from the original instructions; 

adding a jump instruction to the pseudooriginal code to return to a next instruction 
after the original instructions; and 

replacing the original code while the original code is in the process of being 
executed on the processor with tag instructions that indicate only their execution and a transfer of 
control to a hook^ 

wherein the original instructions are part of the instruction set of the processor 
available to a user . 

28. (original) The method of claim 27, wherein the original instructions are changed in 
reverse order. 

29. (original) The method of claim 27, wherein the tag instructions are the same length, 
in bytes, as the instructions to be changed. 
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30. (original) The method of claim 27, wherein the tag instructions are shorter in length, 
in bytes, as the instructions to be changed, and include NOP (no operation) filler. 

31. (original) The method of claim 27, wherein the modified instructions include a 
resolver to determine a number of the instructions at a location of the original code that had 
already been executed. 

32. (original) The method of claim 31, wherein the resolver determines a number of 
instructions that had already been executed using the tag instructions. 

33. (original) The method of claim 32, wherein, if the number of instructions that had 
already been executed is less than a number of original instructions to be changed, the resolver 
calls the pseudooriginal code so as to imitate a "no patch installed" scenario. 

34. (original) The method of claim 33, wherein, after execution of the pseudooriginal 
code, the resolver returns control to the next instruction. 

35. (original) The method of claim 27, fiirther comprising reconciling addressing in the 
instructions in the storage location. 

36. (original) The method of claim 27, fiirther comprising verifying that the original code 
is susceptible to patching. 

37. (original) The method of claim 36, wherein the verifying step determines whether 
any tag instructions are already present in the original instructions. 

38. (original) The method of claim 27, fiirther comprising placing the hook in memory. 
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39. (original) The method of claim 27, wherein the replacing step uses an atomic write to 

replace the original instructions. 

40. (currently amended) A method of on-the-fly patching of executable code comprising: 
identifying original instructions to be changed while the original instructions are being 

executed on a processor: 

allocating a storage location for storing a functionally equivalent copy of the original 

instructions; 

copying the original instructions to the storage location; and 

replacing the original instructions while the original instructions are in the process of 
being executed on the processor with mark instructions and a transfer of control to a hook^ 

wherein the original instructions are part of the instruction set of the processor available 
to a user . 

41. (original) The method of claim 40, further comprising, prior to the allocating step, 
allowing a write operation on a page in memory where the original instructions are located. 

42. (original) The method of claim 40, fiirther comprising adding a jump instruction to 
the copied instructions to return control to a next instruction after the original instructions. 

43. (original) The method of claim 40, wherein the original instructions are changed in 
reverse order. 

44. (original) The method of claim 40, wherein the modified instructions include a 
resolver to determine a number of the instructions at a location of the original instructions that 
had already been executed. 

45. (original) The method of claim 44, wherein the resolver determines a number of 
instructions that had already been executed using the mark instructions. 
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46. (original) The method of claim 45, wherein, if the number of instructions that had 
already been executed is less than a number of original instructions to be changed, the resolver 
calls the functionally equivalent copy so as to imitate a "no patch installed" scenario. 

47. (original) The method of claim 46, wherein, after execution of the fimctionally 
equivalent copy, the resolver returns control to the next instruction. 

48. (original) The method of claim 40, further comprising verifying that the original 
instructions are susceptible to patching. 

49. (original) The method of claim 48, wherein the verifying step determines whether 
any mark instructions are already present in the original instructions. 

50. (original) The method of claim 48, wherein the verifying step determines whether 
any copy protect instructions are already present in the original instructions. 

5 1 . (original) The method of claim 40, wherein the replacing step uses an atomic write to 
replace the original instructions. 

52. (original) The method of claim 40, further comprising enabling functionality of the 
copied instructions at the storage location. 

53. (currently amended) A computer useable medium having computer program logic 
stored thereon for executing on a processor, for on-the-fly patching of executable code, the 
computer program logic comprising: 

A computer program product for on the fly patching of oxocutablo code, the 
computer program product comprising a computer us e abl e m e dium having computer program 
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logic rocordod thoroon for controlling at loast ono processor, tho computor program logic 

comprising: 

computer program code means for identifying original instructions to be changed 
while the original instructions are being executed on a processor: 

computer program code means for copying the original instructions to a storage 

location; 

computer program code means for adding a jump instruction to the copied 
instructions to return to a next instruction after the original instructions; and 

computer program code means for replacing the original instructions while the 
original instructions are in the process of being executed on the processor with mark instructions 
and a transfer of control to a hook^ 

wherein the original instructions are part of the instruction set of the processor 
available to a user . 

54. (currently amended) The computer program logic product of claim 53 52, wherein the 
original instructions are changed in reverse order. 

55. (currently amended) The computer program logic product of claim 53, wherein the 
mark instructions are the same length, in bytes, as the instructions to be changed. 

56. (currently amended) The computer program logic product of claim 53, wherein the 
mark instructions are shorter in length, in bytes, as the instructions to be changed, and include 
NOP (no operation) filler. 

57. (currently amended) The computer program logic product of claim 53, wherein the 
hook includes a resolver to determine a number of the instructions at a location of the original 
code that had already been executed. 

58. (canceled) 
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59. (currently amended) The computer program logic product of claim 58 54, wherein, if 
the number of instructions that had already been executed is less than a number of original 
instructions to be changed, the resolver calls the copied instructions at the storage location so as 
to imitate a "no patch installed" scenario. 

60. (currently amended) The computer program logic product of claim 59 %%, wherein, 
after execution of the instructions to the storage location, the resolver returns control to the next 
instruction. 

61. (currently amended) The computer program logic product of claim 53, further 
comprising computer program code means for enabling functionality of the copied instructions at 
the storage location. 

62. (currently amended) The computer program logic product of claim 61, wherein the 
computer program code means for enabling functionality of the copied instructions at the storage 
location comprises computer program code means for reconciling addressing in the instructions 
in the storage location. 

63. (currently amended) The computer program logic product of claim 53, further 
comprising computer program code means for verifying that the original code is susceptible to 
patching. 

64. (currently amended) The computer program logic product of claim 63 wherein 
the computer program code means for verifying determines whether any mark instructions are 
already present in the original instructions. 

65. (canceled) 
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66. (currently amended) The computer program logic product of claim 53, wherein the 
computer program code means for replacing uses an atomic write to replace the original 
instructions. 

67. (currently amended) A computer useable medium having computer program logic 
stored thereon for executing on a processor, for on-the-fly patching of executable code, the 
computer program logic comprising: 

A computer program product for on the fly patching of executable code, the computer 
program product comprising a computer useable medium having computer program logic 
recorded thoroon for controlling at least one processor, the computer program logic comprising: 

computer program code means for verifying that original instructions to be changed are 
susceptible to patching while the original instructions are being executed on a processor : 

computer program code means for generating pseudooriginal code from the original 
instructions at a different storage location from the original instructions; 

computer program code means for adding a jump instruction to the pseudooriginal code 
to return to a next instruction after the original instructions; and 

computer program code means for replacing the original code while the original code is 
in the process of being executed on the processor with tag instructions that indicate only their 
execution and a transfer of control to a hook^ 

wherein the original instructions are part of the instruction set of the processor available 
to a user . 

68. (currently amended) A computer useable medium having computer program logic 
stored thereon for executing on a processor, for on-the-fly patching of executable code, the 
computer program logic comprising: 

A computer program product for on - the - fly patching of executable code, the computer 
program product comprising a computer useable medium having computer program logic 
r e cord e d th e r e on for controlling at least one processor, the computer program logic comprising: 
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computer program code means for identifying original instructions to be changed while 
the original instructions are executed on a processor ; 

computer program code means for allocating a storage location for storing a functionally 
equivalent copy of the original instructions; 

computer program code means for copying the original instructions to the storage 
location; and 

computer program code means for replacing the original instructions while the original 
instructions are in the process of being executed on the processor with mark instructions and a 
transfer of control to a hook^^ 

wherein the original instructions are part of the instruction set of the processor available 
to a user . 

69. (currently amended) A system for on-the-fly patching of executable code comprising: 
means for identifying original instructions to be changed while the instructions are being 

executed on a processor; 

means for copying the original instructions to a storage location; 

means for adding a jump instruction to the copied instructions to return to a next 
instruction after the original instructions; and 

means for replacing the original code as while the code is in the process of being 

executed on the processor w ith mark instructions and a transfer of control to a hook^ 

wherein the original instructions are part of the instruction set of the processor available 
to a user . 

70. (currently amended) A system for on-the-fly patching of executable code comprising: 
means for verifying that original instructions to be changed are susceptible to patching 

while the instructions are being executed on a processor; 

means for generating pseudooriginal code from the original instructions at a different 
storage location from the original instructions; 
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means for adding a jump instruction to the enabled pseudooriginal code to return to a 
next instruction after the original instructions; and 

means for replacing the original code while the original code is in the process of being 
executed on the processor with tag instructions that indicate only their execution and a transfer of 
control to a hook^ 

wherein the original instructions are part of the instruction set of the processor available 
to a user . 

71. (currently amended) A system for on-the-fly patching of executable code comprising: 
means for identifying original instructions to be changed while the instructions are 

executed on a processor: 

means for allocating a storage location for storing a functionally equivalent copy of the 

original instructions; 

means for copying the original instructions to the storage location; and 

means for replacing the original instructions while the original instructions are in the 

process of being executed on the processor with mark instructions and a transfer of control to a 

hooki 

wherein the original instructions are part of the instruction set of the processor available 
to a user . 

72. (new) The method of claim 1, wherein the process of execution of the original 
instructions is not interrupted throughout the patching process. 

73. (new) The method of claim 27, wherein the process of execution of the original code 
is not interrupted throughout the patching process. 
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